AIKIDO-2026-194663
Mbed-TLS.mbedtls is vulnerable to Use of Insufficiently Random Values
77
High Risk
This Affects:
Mbed-TLS.mbedtlsTL;DR
The PSA random generator in Mbed TLS keeps its seed state in memory and does not reseed when the surrounding application is cloned. When a process is duplicated through fork(), virtual machine cloning, or resuming a hibernation image, every clone continues from the same random state. As a result the clones produce identical random values, which can compromise keys and nonces generated afterward. The fix detects cloning and reseeds so each instance produces independent randomness.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application clones its process or virtual machine state after initializing the PSA random generator.
Background info
Mbed-TLS.mbedtls is vulnerable to Use of Insufficiently Random Values in versions 2.18.0 - 3.6.5 and 4.0.0 - 4.0.0.
How to fix this
Upgrade the Mbed-TLS.mbedtls library to the patch version.
Links
GitHub Release
Other
mbed-tls.readthedocs.io/en/latest/security-advisories/mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-rng-cloning/
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant